CVAT vulnerabilities

CVAT, an open source annotation tool, versions 2.68.0 to 2.70.0 contain an XSS vulnerability in the audio annotation guide renderer. A user with guide creation/edit privileges can store malicious JavaScript that executes when another user opens the guide, allowing arbitrary CVAT requests with victim privileges. Fixed in version 2.70.0.

CVAT from version 2.17.0 until 2.72.0 has a vulnerability that allows a user with the Worker role to use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.

CVAT is an open source interactive video and image annotation tool. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request with inconsistent task and job IDs, blocking automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.

In CVAT versions 2.5.0 through 2.66.0, there is an XSS vulnerability accessible through annotation guide assets. When CVAT serves files attached to an annotation guide, it labels them with a media type that the attacker can influence, allowing the victim's browser to treat the file as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0.

CVAT versions 1.6.0 through 2.64.0 contain a vulnerability that allows an attacker with write access to a cloud storage added to a CVAT instance, or ability to add new cloud storages, to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.

A vulnerability in CVAT before version 2.69.0 in the QualityReportViewSet.get_queryset allows authenticated attackers to enumerate quality report identifiers belonging to other organizations. The missing check_object_permissions call on the parent_id parameter in the quality reports API endpoint enables distinguishing existing and non-existing reports via HTTP 500 vs 404 responses.